CVE-2021-33037

 

Published at: - 12-07-2021 05:15

Last modified: - 21-08-2022 07:15

Total changes: - 22

Description

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

 

Verification logic

 

Reference

• https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E
• N/A-Patch, Third Party Advisory
• [tomee-commits] 20210728 [jira] [Created] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037-Mailing List, Third Party Advisory
• [tomee-commits] 20210728 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037-Mailing List, Third Party Advisory
• [debian-lts-announce] 20210805 [SECURITY] [DLA 2733-1] tomcat8 security update-Mailing List, Third Party Advisory
• DSA-4952-Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210827-0007/
• [tomee-commits] 20210830 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037-Mailing List, Third Party Advisory
• [tomee-commits] 20210913 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037-Mailing List, Third Party Advisory
• [tomee-commits] 20210914 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037-Mailing List, Third Party Advisory
• [tomee-commits] 20210916 [jira] [Resolved] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• GLSA-202208-34-

 

Keywords

NVD

 

CVE-2021-33037

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures